> For the complete documentation index, see [llms.txt](https://docs.pagsmile.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.pagsmile.com/reference/payin/submit-a-payin/brazil/creditcard.md).

# Credit Card

How to use CreditCard to submit a payin in Brazil.

Use the following server-side flow to submit a Credit Card payment in Brazil:

1. Tokenize the card details.
2. Submit the payment using the returned card token.
3. If 3DS verification is required, redirect the customer to the returned `check_url`.

### Step 1: Tokenize the card

Send the card details to Pagsmile and obtain a temporary card token.

#### Endpoint

<mark style="color:green;">`POST`</mark> `https://security-test.pagsmile.com/card/tokenize`

#### Request body

<table><thead><tr><th width="206.5234375">Parameter</th><th>Type</th><th width="87.32421875">Required</th><th>Constraints</th><th>Description</th></tr></thead><tbody><tr><td><code>app_id</code></td><td>string</td><td>Yes</td><td>Maximum 32 characters.</td><td>Merchant application ID assigned by Pagsmile.</td></tr><tr><td><code>version</code></td><td>string</td><td>No</td><td>Fixed value: <code>2.0</code>; defaults to <code>2.0</code> when omitted.</td><td>API version.</td></tr><tr><td><code>timestamp</code></td><td>string</td><td>Yes</td><td>Format: <code>yyyy-MM-dd HH:mm:ss</code>; maximum 19 characters.</td><td>Time at which the request is sent.</td></tr><tr><td><code>card.card_no</code></td><td>string</td><td>Yes</td><td>Maximum 32 characters.</td><td>Card number.</td></tr><tr><td><code>card.issuer</code></td><td>string</td><td>Yes</td><td>For example, <code>visa</code> or <code>mastercard</code>.</td><td>Card brand.</td></tr><tr><td><code>card.holder.name</code></td><td>string</td><td>Yes</td><td>Maximum 64 characters.</td><td>Name printed on the card.</td></tr><tr><td><code>card.cvv</code></td><td>string</td><td>Yes</td><td>Maximum 8 characters.</td><td>Card security code. Never store this value.</td></tr><tr><td><code>card.valid_thru_year</code></td><td>string</td><td>Yes</td><td>Four digits in <code>YYYY</code> format.</td><td>Card expiration year.</td></tr><tr><td><code>card.valid_thru_month</code></td><td>string</td><td>Yes</td><td>Two digits from <code>01</code> to <code>12</code>.</td><td>Card expiration month.</td></tr></tbody></table>

#### Request example

```json
{
  "app_id": "161***24",
  "version": "2.0",
  "timestamp": "2026-08-14 13:18:10",
  "card": {
    "card_no": "4****9",
    "issuer": "visa",
    "holder": {
      "name": "****"
    },
    "cvv": "111",
    "valid_thru_year": "2030",
    "valid_thru_month": "10"
  }
}
```

#### Response example

```json
{
  "code": "10000",
  "msg": "Success",
  "token": "psct_5a****de"
}
```

{% hint style="info" %}
The card token expires one hour after it is created. Use it promptly when submitting the payment.&#x20;
{% endhint %}

### Step 2: Submit the payment

Use the token returned in Step 1 to create and process the Credit Card payment.

#### Endpoint

<mark style="color:green;">`POST`</mark>`https://gateway-test.pagsmile.com/trade/pay`

#### Request body

<table><thead><tr><th width="161.765625">Parameter</th><th width="99.7109375">Type</th><th>Required</th><th>Constraints</th><th>Description</th></tr></thead><tbody><tr><td><code>app_id</code></td><td>string</td><td>Yes</td><td>Maximum 32 characters. Must match the application used to generate the card token.</td><td>Merchant application ID assigned by Pagsmile.</td></tr><tr><td><code>version</code></td><td>string</td><td>No</td><td>Fixed value: <code>2.0</code>; defaults to <code>2.0</code> when omitted.</td><td>API version.</td></tr><tr><td><code>timestamp</code></td><td>string</td><td>Yes</td><td>Format: <code>yyyy-MM-dd HH:mm:ss</code>; maximum 19 characters.</td><td>Time at which the request is sent.</td></tr><tr><td><code>out_trade_no</code></td><td>string</td><td>Yes</td><td>Maximum 64 characters; must be unique for the merchant application.</td><td>Merchant order number.</td></tr><tr><td><code>method</code></td><td>string</td><td>Yes</td><td>Fixed value: <code>CreditCard</code>.</td><td>Payment method.</td></tr><tr><td><code>trade_type</code></td><td>string</td><td>Yes</td><td>Fixed value: <code>API</code>.</td><td>Indicates a direct API payment.</td></tr><tr><td><code>order_amount</code></td><td>decimal</td><td>Yes</td><td>From <code>0.01</code> to <code>50000.00</code>; maximum two decimal places.</td><td>Payment amount.</td></tr><tr><td><code>order_currency</code></td><td>string</td><td>Yes</td><td>Fixed value: <code>BRL</code>.</td><td>Payment currency.</td></tr><tr><td><code>subject</code></td><td>string</td><td>Yes</td><td>Maximum 128 characters.</td><td>Payment subject or order title.</td></tr><tr><td><code>content</code></td><td>string</td><td>No</td><td>Maximum 255 characters.</td><td>Payment description.</td></tr><tr><td><code>notify_url</code></td><td>string</td><td>Yes</td><td>Must be a valid URL. HTTPS is recommended.</td><td>Endpoint that receives asynchronous payment notifications.</td></tr><tr><td><code>return_url</code></td><td>string</td><td>No</td><td>Must be a valid URL. HTTPS is recommended.</td><td>URL to which the customer is redirected after completing the payment flow.</td></tr><tr><td><code>buyer_id</code></td><td>string</td><td>Yes</td><td>Maximum 128 characters.</td><td>Merchant-side customer ID.</td></tr><tr><td><code>timeout_express</code></td><td>string</td><td>No</td><td>Supports <code>m</code> (minutes), <code>h</code> (hours), <code>d</code> (days), and <code>c</code> (end of the current day). The default is <code>90m</code> and the maximum is <code>15d</code>.</td><td>Time allowed for the payment to move from the initial state to processing.</td></tr><tr><td><code>token</code></td><td>string</td><td>Yes</td><td>Must be the unexpired <code>psct_</code> token returned in Step 1.</td><td>Tokenized card details.</td></tr><tr><td><code>user_ip</code></td><td>string</td><td>Yes</td><td>Valid public IPv4 or IPv6 address.</td><td>Customer IP address used for risk assessment.</td></tr><tr><td><code>installments</code></td><td>string</td><td>No</td><td>Positive integer represented as a string; defaults to <code>1</code>. Available values depend on the merchant and channel configuration.</td><td>Number of installments.</td></tr><tr><td><code>issuer</code></td><td>string</td><td>Yes</td><td>Must match the card brand, for example <code>visa</code> or <code>mastercard</code>.</td><td>Card brand.</td></tr></tbody></table>

#### Request example

```json
{
  "app_id": "16***4",
  "timestamp": "2026-08-14 14:21:25",
  "out_trade_no": "out_tr***58",
  "method": "CreditCard",
  "order_amount": "0.11",
  "order_currency": "BRL",
  "subject": "descriptor-PAGSMIL*Hype games",
  "content": "trade pay content",
  "trade_type": "API",
  "notify_url": "http://demo.gemini-tiger.cn/callback/success",
  "return_url": "https://www.xcloudgame.com/",
  "buyer_id": "111222",
  "timeout_express": "1c",
  "token": "psct_5a7***de",
  "user_ip": "8.29.109.148",
  "installments": "1",
  "issuer": "visa"
}
```

#### Response example

```json
{
  "code": "10000",
  "msg": "Success",
  "prepay_id": "VD****B8",
  "trade_no": "202***56",
  "out_trade_no": "out_t***58",
  "pay_url": "",
  "trade_status": "RISK_CONTROLLING",
  "check_url": "https://checkout-test.pagsmile.com/public/redirect/3ds-direct?prepay_id=b0***6e9&token=psct_c1****39"
}
```

### Complete 3DS verification

When `trade_status` is `RISK_CONTROLLING` and `check_url` is returned:

1. Redirect the customer's browser to the complete `check_url` returned by Pagsmile.
2. Do not construct or modify the URL or its query parameters.
3. Allow the customer to complete the 3DS challenge or verification flow.
4. Use the payment notification or the Payin Detail API to determine the final payment status.